[SecurityBundle] Revert adding _stateless attribute to the request when firewall is stateless and the attribute is not already set
#58017
Conversation
|
I'd go with a bugfix on my side. The side-effect of reverting this on 6.4 would be that requests won't be marked as stateless anymore for some, and that should be fine since this is just adding a safeguard, isn't it? |
|
I agree with reverting this on 6.4. |
…when firewall is stateless and the attribute is not already set
ad9faa2 to
47baed9
Compare
|
Rebased on 6.4 and updated the description accordingly. @nicolas-grekas yes the only impact is that you’ll no longer be warned about session usage from a route configured as stateless under a stateless firewall. @chalasr not sure about what you’re proposing, but I guess that would be another PR anyway! |
|
Thank you @MatTheCat. |
… routes as stateless (MatTheCat) This PR was merged into the 6.4 branch. Discussion ---------- [Security] Remove note about stateless firewalls marking routes as stateless Following symfony/symfony#58017 Commits ------- 768ef5a [Security] Remove note about stateless firewalls marking routes as stateless
#40372 was about routes matching both stateful and stateless firewalls: you couldn’t easily configure them as stateless under a stateless firewall only.
#48044 fixed it by linking these two attributes: a stateless firewall then implied a stateless request. While it can sound logical, this impacted many projects using the session while authenticating users in a stateless fashion.
At last, #49997 allowed to override this behavior by explicitly configuring routes as not stateless. This kind of proved that #48044 was a mistake: you cannot tell a request must be stateless only because it matches a stateless firewall.
As such, this PR reverts #48044 (and consequently #49997) so that configuring routes as stateless is the developers responsibility alone. It also reopens #40372, but I think this issue should be fixed in an opt-in way (with a new
firewall.stateless.with_routesboolean configuration in the SecurityBundle e.g.).